[c-nsp] netflow

[Ivan Gasparik]

you can decrease the SP load by adding a DFC's to your line cards. DFC 
will do gathering statistics from forwarding hardware and populating 
netflow entries in netflow cache. all this is load caused by 
interrupts as you can see it now in SP CPU utilization.
SP will then do only the export work - generating and sending packets 
to your netflow collector, this part of CPU load is seen as NDE 
process on SP.
in addition, DFC's will enlarge your netflow cache, on 3BXL system you 
will have 256k entries per every line card.

ivan


On Tuesday 20 November 2007, Dale W. Carder wrote:
> On Nov 20, 2007, at 8:54 AM, Jeff Fitzwater wrote:
> > We are runnning it on a 720-3B with aprox 30 SVIs and aprox 150
> > L2 ports that are associated with the SVI vlans.   As soon as I
> > enable the MLS (hardware switched flows) portion of the netflow,
> > the switch CPU jumps up to around 50-80.
>
> I've seen 60% on the SP with a consistently full netflow
> table on a 3BXL.  Since it is on the SP cpu, we haven't
> been particularly concerned.
>
> >   Since we want to collect all flows, we
> > do not want to do sampled flows.
>
> Good thing you don't want it, because the 6500 can't do
> hardware sampling.
>
> Dale
>
> ----------------------------------
> Dale W. Carder - Network Engineer
> University of Wisconsin at Madison
> http://net.doit.wisc.edu/~dwcarder
>
>
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/